Verify webhooks

Always verify the signature before trusting a webhook. See Webhooks → Verify the signature for Node.js and Python examples using the svix library.

Without a library: compute HMAC-SHA256(secret, "{svix-id}.{svix-timestamp}.{raw body}") using the base64-decoded part of your whsec_ secret, base64-encode it, and compare with each v1, value in svix-signature. Reject timestamps older than 5 minutes.